Add basic expanded sflow tests

cloudflare / goflow

The high-scalability sFlow/NetFlow/IPFIX collector used internally at Cloudflare.

BSD 3-Clause "New" or "Revised" License

859 stars 172 forks source link

Add basic expanded sflow tests #48

Closed simPod closed 4 years ago

simPod commented 4 years ago

I have been debugging expanded sflow parsing and for that I wrote these 2 tests.

(I was not sure it was being parsed properly. The error in the end was in reading prometheus metrics (wrong label filter) so everything in goflow works as expected)

I though might share rather than removing it, WDYT?

lspgn commented 4 years ago

LGTM. Thank you for writing the test :) .

lspgn commented 4 years ago

Sorry I've been taking too long at verifying this PR.

Are you sure you want to share a real sFlow sample? I'm noticing a few ip addresses in there that don't seem to be obfuscated.

simPod commented 4 years ago

I merged two flow samples into one so it should not represent real communication. Do you think it is not safe still?

lspgn commented 4 years ago

I'd be careful in case of an audit: non-obfuscated PII (even if long ago) since it's the full sFlow packet. Would prefer not have to clear the whole git history if that were to cause an issue.